diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep index 9992bfb84..9f1824e8c 100644 --- a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep +++ b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep @@ -70,6 +70,20 @@ param parVmBackupExclusionTagName string = '' @description('Tag value for excluding VMs from this policy scope.') param parVmBackupExclusionTagValue array = [] +@description('Resource group name for the service health alert rule. Used by the Deploy-SvcHealth-BuiltIn policy assignment.') +param parServiceHealthAlertResourceGroupName string = 'rg-serviceHealthAlert' + +@description('Action group resources configuration for the service health alert rule. Used by the Deploy-SvcHealth-BuiltIn policy assignment.') +param parServiceHealthAlertActionGroupResources object = { + actionGroupEmail: [] + webhookServiceUri: [] + logicappResourceId: '' + logicappCallbackUrl: '' + eventHubResourceId: [] + functionResourceId: '' + functionTriggerUrl: '' +} + @description('Names of policy assignments to exclude from the deployment entirely.') param parExcludedPolicyAssignments array = [] @@ -1011,6 +1025,17 @@ module modPolAssiIntRootDeploySvcHealthBuiltIn '../../../policy/assignments/poli parPolicyAssignmentDescription: varPolicyAssignmentDeploySvcHealthBuiltIn.libDefinition.properties.description parPolicyAssignmentNotScopes: varPolicyAssignmentDeploySvcHealthBuiltIn.libDefinition.properties.notScopes parPolicyAssignmentParameters: varPolicyAssignmentDeploySvcHealthBuiltIn.libDefinition.properties.parameters + parPolicyAssignmentParameterOverrides: { + resourceGroupLocation: { + value: parLogAnalyticsWorkSpaceAndAutomationAccountLocation + } + resourceGroupName: { + value: parServiceHealthAlertResourceGroupName + } + actionGroupResources: { + value: parServiceHealthAlertActionGroupResources + } + } parPolicyAssignmentIdentityType: varPolicyAssignmentDeploySvcHealthBuiltIn.libDefinition.identity.type parPolicyAssignmentIdentityRoleDefinitionIds: [ varRbacRoleDefinitionIds.monitoringPolicyContributor diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md index d43153fa5..3685e744f 100644 --- a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md +++ b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md @@ -28,6 +28,8 @@ parPolicyAssignmentsToDisableEnforcement | No | Set the enforcement mode t parDisableAlzDefaultPolicies | No | Set the enforcement mode to DoNotEnforce for all default ALZ policies. parVmBackupExclusionTagName | No | Tag name for excluding VMs from this policy scope. parVmBackupExclusionTagValue | No | Tag value for excluding VMs from this policy scope. +parServiceHealthAlertResourceGroupName | No | Resource group name for the service health alert rule. Used by the Deploy-SvcHealth-BuiltIn policy assignment. +parServiceHealthAlertActionGroupResources | No | Action group resources configuration for the service health alert rule. Used by the Deploy-SvcHealth-BuiltIn policy assignment. parExcludedPolicyAssignments | No | Names of policy assignments to exclude from the deployment entirely. parTelemetryOptOut | No | Opt out of deployment telemetry. parManagementGroupIdOverrides | Yes | Specify the ALZ Default Management Group IDs to override as specified in `varManagementGroupIds`. Useful for scenarios when renaming ALZ default management groups names and IDs but not their intent or hierarchy structure. @@ -180,6 +182,22 @@ Tag name for excluding VMs from this policy scope. Tag value for excluding VMs from this policy scope. +### parServiceHealthAlertResourceGroupName + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Resource group name for the service health alert rule. Used by the Deploy-SvcHealth-BuiltIn policy assignment. + +- Default value: `rg-serviceHealthAlert` + +### parServiceHealthAlertActionGroupResources + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Action group resources configuration for the service health alert rule. Used by the Deploy-SvcHealth-BuiltIn policy assignment. + +- Default value: `@{actionGroupEmail=System.Object[]; webhookServiceUri=System.Object[]; logicappResourceId=; logicappCallbackUrl=; eventHubResourceId=System.Object[]; functionResourceId=; functionTriggerUrl=}` + ### parExcludedPolicyAssignments ![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) @@ -278,6 +296,20 @@ Specify the ALZ Default Management Group IDs to override as specified in `varMan "parVmBackupExclusionTagValue": { "value": [] }, + "parServiceHealthAlertResourceGroupName": { + "value": "rg-serviceHealthAlert" + }, + "parServiceHealthAlertActionGroupResources": { + "value": { + "actionGroupEmail": [], + "webhookServiceUri": [], + "logicappResourceId": "", + "logicappCallbackUrl": "", + "eventHubResourceId": [], + "functionResourceId": "", + "functionTriggerUrl": "" + } + }, "parExcludedPolicyAssignments": { "value": [] }, diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json index e72241c6e..8637aba0a 100644 --- a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json +++ b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json @@ -71,6 +71,20 @@ "parVmBackupExclusionTagValue": { "value": [] }, + "parServiceHealthAlertResourceGroupName": { + "value": "rg-serviceHealthAlert" + }, + "parServiceHealthAlertActionGroupResources": { + "value": { + "actionGroupEmail": [], + "webhookServiceUri": [], + "logicappResourceId": "", + "logicappCallbackUrl": "", + "eventHubResourceId": [], + "functionResourceId": "", + "functionTriggerUrl": "" + } + }, "parExcludedPolicyAssignments": { "value": [] }, diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_svchealth_builtin.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_svchealth_builtin.tmpl.json index 75aa78c38..15b41ffe8 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_svchealth_builtin.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_svchealth_builtin.tmpl.json @@ -6,7 +6,28 @@ "description": "Assignable at the subscription or management group level, this policy ensures that each subscription has a service health alert rule configured with alert conditions and mapping to action groups as specified in the policy parameters. By default creates a resource group, alert rule and action group configured to send emails to subscription owners for all service health events.", "displayName": "Configure subscriptions to enable service health alert monitoring rule", "notScopes": [], - "parameters": {}, + "parameters": { + "resourceGroupLocation": { + "value": "placeholder" + }, + "resourceGroupName": { + "value": "rg-serviceHealthAlert" + }, + "actionGroupResources": { + "value": { + "actionGroupEmail": [], + "webhookServiceUri": [], + "logicappResourceId": "", + "logicappCallbackUrl": "", + "eventHubResourceId": [], + "functionResourceId": "", + "functionTriggerUrl": "" + } + }, + "actionGroupRoleIds": { + "value": ["Owner"] + } + }, "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/98903777-a9f6-47f5-90a9-acaf62ab01a8", "definitionVersion": "1.*.*-preview", "scope": null,